Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Events Skill Security Audit

What the author says it does (original text)

Subscribe to Google Workspace events.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

A missing shared prerequisite triggers a generator that writes local Skill files

Source references: 1
What we found

The Skill explicitly says to run `gws generate-skills` when `../gws-shared/SKILL.md` is absent. This is a persistent local operation beyond subscribing to events, and the supplied material does not show which files or instructions it generates.

Why this matters

Using the Skill may create or update files in neighboring Skill directories. The generated authentication and security instructions can then affect how the agent accesses a Google account, but those instructions cannot be verified here.

This is an active prerequisite: if the shared skill file is absent, the agent is told to run a generation command. The text explicitly says the command creates a file, so it can make persistent local changes, while the provided source does not disclose the full write scope, overwrite behavior, or generated content. A user can ask the author for exact output paths and overwrite rules, or restrict the agent to read-only use and require it to stop when the prerequisite is missing.

SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is a command reference for Google Workspace Events. It uses `gws events <resource> <method>` and instructs the agent to inspect help and the method schema before each API call.

View source
SKILL.md:18In the instructionsOpen original file
```bashgws events <resource> <method> [flags]```
SKILL.md:57In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws events --help# Inspect a method's required params, types, and defaultsgws schema events.<resource>.<method>```Use `gws schema` output to build your `--params` and `--json` flags.

The listed API includes operations that change external Google Workspace state—not just event reading—including creating, deleting, updating, renewing, or reactivating subscriptions and canceling agent tasks. These lines describe capabilities rather than directly instructing their execution.

View source
SKILL.md:41In the instructionsOpen original file
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).  - `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).  - `patch` — Updates or renews a Google Workspace subscription. To learn how to use this method, see [Update or renew a Google Workspace subscription](https://developers.google.com/workspace/events/guides/update-subscription).  - `reactivate` — Reactivates a suspended Google Workspace subscription. This method resets your subscription's `State` field to `ACTIVE`. Before you use this method, you must fix the error that suspended the subscription. This method will ignore or reject any subscription that isn't currently in a suspended state. To learn how to use this method, see [Reactivate a Google Workspace subscription](https://developers.google.com/workspace/events/guides/reactivate-subscription).
SKILL.md:50In the instructionsOpen original file
  - `cancel` — Cancel a task from the agent. If supported one should expect no more task updates for the task.  - `get` — Get the current state of a task from the agent.  - `subscribe` — TaskSubscription is a streaming call that will return a stream of task update events. This attaches the stream to an existing in process task. If the task is complete the stream will return the completed task (like GetTask) and close the stream.  - `pushNotificationConfigs` — Operations on the 'pushNotificationConfigs' resource

The Skill delegates authentication, global flags, and security rules to a shared Skill that is not included in the supplied source. If absent, it instructs the agent to generate that file, so the actual authorization scope and generated instructions cannot be verified from this material.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-events
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:18In the instructionsOpen original file
```bashgws events <resource> <method> [flags]
SKILL.md:59In the instructionsOpen original file
```bash# Browse resources and methods
Connect to websites
SKILL.md:41In the instructionsOpen original file
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).
SKILL.md:42In the instructionsOpen original file
  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).
SKILL.md:43In the instructionsOpen original file
  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).  - `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).
Lines read
69
File checksum (to compare versions)
62a1c6ff7bd74a33ebc4376724116ccdb63aca01689c1b3740365f46e8a5e9bb